The British Columbia Supreme Court has certified a class action law suit against Facebook for breach of privacy rights protected under B.C.’s Privacy Act. In doing so, it dismissed Facebook’s application to have the court decline jurisdiction to hear the case.

The claim in Douez v. Facebook, Inc. relates to Facebook’s Sponsored Stories “product”.Sponsored Stories permits paid advertisers to use the names and likenesses of users of Facebook, alongside information about their product and service and their trademarks. The resulting “Sponsored Stories” are then sent to the contacts of the person featured in the ‘story’. The court found that between September 9, 2012 and March 10, 2013, 1.8 million B.C. residents were featured in Sponsored Stories. Individual Facebook users are given no notice of the fact that they are featured in a Sponsored Story. The class Plaintiff Douez argued that the use of the names and images of herself and other Facebook users from B.C. violated s. 3(2) of the Privacy Act, which provides:

3. (2) It is a tort, actionable without proof of damage, for a person to use the name or portrait of another for the purpose of advertising or promoting the sale of, or other trading in, property or services, unless that other, or a person entitled to consent on his or her behalf, consents to the use for that purpose.

Facebook argued that all of its users must accept its terms of use and privacy policy in order to use the site. In this way, it obtains the express consent of users to have their names and images used in Sponsored Stories. It also put forward a secondary argument regarding implied consent.

The focus of Facebook’s application to have the Plaintiff’s certification application dismissed was an argument based upon the lack of jurisdiction of the B.C. Supreme Court over the matter. Facebook argued that its Terms of Use, to which all users must consent, contains a forum selection clause that provides that disputes will be heard by the courts of California. Justice Griffin of the B.C. Supreme Court noted that the choice of jurisdiction clause was found near the end of exceeding long terms of use, making it relatively obscure. She distinguished an earlier Ontario case, Rudder v. Microsoft Corp which upheld a choice of jurisdiction clause in an online consumer contract on the basis that the claim in that case was one of breach of contract. The plaintiffs in Rudder therefore relied on the terms of the contract on the one hand, and claimed not to be bound on the other. She also distinguished the more recent BC Supreme Court decision in Century 21 Canada Ltd. Partnership v. Rogers Communications Inc., which also held that the parties were bound by online terms of use, on the basis that both were “sophisticated commercial parties who employ similar terms of use themselves and who had conceded the reasonableness of the terms of use at issue.” (at para 45).

Justice Griffin found that the plaintiff had shown strong cause for the court not to enforce the forum selection clause. She noted that the B.C. Privacy Act gave exclusive jurisdiction over claims arising under that Act to the B.C. Supreme Court. As a result, a California court could not have jurisdiction over such a claim. She took note as well of the “cultural differences in the ways various jurisdictions think of a right to privacy”, suggesting that a court in California might not interpret the right of privacy in the Privacy Act in a manner consistent with Canadian approaches to privacy. She concluded that “the availability of a statute-based claim in the court’s own jurisdiction, which confers exclusive jurisdiction on that court, can on its own be a basis for overriding a forum selection clause, but also can support two other “strong causes” for not enforcing a forum selection clause, namely, juridical advantage and public policy.” (at para 93).According to Justice Griffin, a court in California would have no jurisdiction over a Privacy Act claim, such that enforcing the forum selection clause would rob the plaintiff of her recourse. Further, she found that the protection of privacy was a matter of important public policy. She also noted that “with the creation and growth of the internet the potential implications for a loss of privacy are greater than ever. The difficulty in proving quantifiable damage remains great for an individual whose privacy is lost, but the social harm can be monumental if the loss of privacy includes publicity over the internet with its almost infinite reach and timelessness.” (at para 104). In addition to these reasons for not enforcing the forum selection clause, Justice Griffin found that it would cause much less hardship overall for Facebook to defend itself in B.C. than for the plaintiff and her witnesses to travel to California to plead their case.

A recent decision of the Federal Court of Canada may demonstrate a new willingness to give greater bite to the rather limited recourses available under federal data protection legislation for privacy breaches.

A chronic problem with private sector data protection law in Canada has been the rather impoverished remedial arsenal available to address privacy breaches. In those contexts where the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, for example, the Federal Privacy Commissioner plays the role of an ombud. She is able to investigate complaints and to make recommendations, but has no order-making powers. She has recommended that PIPEDA be amended not only to give her such powers, but also to enable her to impose fines on organizations in cases of egregious privacy breaches. Parliament, however, has shown little interest in amending PIPEDA to address these and other concerns.

Absent any real enforcement powers in the hands of the Privacy Commissioner, individuals who have filed complaints under PIPEDA receive a report on the investigation of their complaint, complete with non-binding recommendations. Should they wish to see these recommendations enforced by court order, or should they wish to receive compensation for any damage they have suffered, they must take the matter to Federal Court. To date, relatively few have chosen this option, all have been unrepresented, and only a handful have been successful in obtaining damage awards. Where damages have been awarded, the amounts have been relatively small.

This is why the recent decision in Chitraker v. Bell TV is interesting.In this case, the applicant sought damages for breaches of Bell TV’s legal obligations under PIPEDA. Chitraker had ordered satellite TV service from Bell, and had signed an electronic Proof of Delivery Device when the service was installed in his home. Bell TV then lifted the signature from this device, without Chitraker’s knowledge, and affixed his signature to a contract. Chitraker had not been given a copy of this contract. Among other things, the contract provided that the customer consents to Bell TV performing a credit check. Relying on this clause, Bell accessed Chitraker’s credit history without his actual knowledge or consent. When he later learned of this, Chitraker contacted Bell to begin what turned out to be a long and fruitless customer service runaround. The most he received from Bell was an apology left in his voicemail. Chitraker eventually filed a Complaint with the Office of the Privacy Commissioner of Canada (OPC). The complaint was investigated, ruled well-founded, and recommendations were made to allow Bell to bring itself into compliance with the law. Chitraker then took the matter to the Federal Court, seeking compensatory and aggravated damages for the breach of his privacy rights, and for Bell TV’s “malicious and high-handed conduct” (at para 1).

As is typical in these cases, Chitraker represented himself before the Federal Court. Less typical was Bell TV’s failure to respond to the applicaton. Justice Phelan noted that this “failure to appear in this Court is consistent with its disregard of Chitraker’s privacy rights.”(at para 18). He also noted that without any submissions from Bell it was impossible to know whether the company had implemented any of the OPC’s recommendations.

Justice Phelan was critical of Bell’s failure to compensate Chitraker for what he considered to be a significant breach of his privacy rights, and one that might have had actual adverse consequences for him. He noted that Bell took no steps “to compensate for breach of Chitraker’s privacy rights” (para 22). This wording is interesting since there is nothing in the Act which speaks of an obligation to “compensate”. For the most part, PIPEDA is currently oriented towards correcting improper business practices. Certainly in this case, the court was critical of Bell’s apparent lack of interest in doing even this much; nevertheless, the language used may signal a greater openness to actual compensation for harm suffered. In spite of the lack of evidence of any direct loss suffered by Chitraker, Justice Phalen was prepared to award damages, noting that “there is no reason to require that the violation be egregious before damages will be awarded.” (para 24) This is a most noteworthy departure from earlier case law. For example, in Randall v. Nubody’s Fitness Centres, Justice Mosely of the same court had ruled that a damage award “should not be made lightly and that such an award should only be made in the most egregious situations”. This point was also cited by the Federal Court in another decision, Nammo v. TransUnion of Canada Inc. In Nammo, the first case in which a damages award was made under s. 16 of PIPEDA, the court had awarded $5,000 for what the court clearly felt qualified as an “egregious” situation.

In Chitraker, Justice Phelan emphasized the importance of privacy rights “in an era where information on an individual is so readily available even without consent.” (at para 25) He also took into account the nature of the respondent, noting that “Bell is a large company for whom a small damages award would have little material impact.” In a notable departure from the rather stingy approach of the court in Nammo, Justice Phelan awarded Chitraker $10,000 in damages, with an additional $10,000 in exemplary damages and a further $1,000 in costs. Although the elevated damage award in this case no doubt reflects the particular circumstances, including Bell’s apparent disinterest in addressing the privacy concerns, it does mark an important departure from the Federal Court’s previous approach to damages under PIPEDA.

The Manitoba government has recently enacted the Personal Information Protection and Identity Theft Protection Act (PIPITPA), which has yet to come into force. This statute is private sector data protection legislation which will is presumably intended to apply in place of the federal Personal Information Protection and Electronic Documents Act (PIPEDA) to private sector activity within provincial jurisdiction. In order to effectively substitute for the application of PIPEDA, the PIPITPA would need to be declared by the federal Governor-in-Council to be substantially similar to PIPEDA. If Manitoba were to be successful, it would join the ranks of Alberta, British Columbia and Quebec as a province with legislation that is substantially similar to PIPEDA. However, as I will explain below, this may be a difficult case to make.

In terms of the substantive norms that guide the collection, use or disclosure of personal information, the Manitoba legislation draws heavily upon Alberta’s Personal Information Protection Act(PIPA). Indeed, many of the provisions of PIPITPA are taken word for word from the Alberta statute. There are, however, some differences. Unlike PIPA, PIPITPA does not create distinct obligations to notify individuals when they outsource the processing or storage of their personal information to a company in another country (see art. 6(2) of PIPA). Neither does PIPITPA require notification of individuals when an organization uses an offshore service provider to collect personal information, or where it transfers personal information to an offshore company (PIPA s. 13.1). The obligations in PIPITPA regarding personal employee information are also slightly different from those in PIPA; they seem to be somewhat more permissive (although such protections are notably absent under PIPEDA).Perhaps one of the most significant substantive differences relates to the date breach notification requirements. Alberta’s PIPA requires the Commissioner to be notified by an organization where there has been unauthorized access to or disclosure of personal information. The Commissioner may then require the organization to notify affected individuals where “there is a real risk of significant harm as a result of the loss or unauthorized access.” Under Manitoba’s new legislation, an organization must “as soon as is reasonably practicable”, notify any individual if their personal information that has been in the custody or control of the organization “is stolen, lost or accessed in an unauthorized manner.” The organization is not required to make such a notification if it is “satisfied that it is not reasonably possible for the personal information to be used unlawfully.” (art. 34)The difference is important: under Alberta’s statute, the Commissioner, at arm’s length, makes the call as to whether notification is required; under the Manitoba legislation it is the organization, facing embarrassment or even possible legal action, that gets to decide whether individuals should be told of the mishandling of their personal information.

The most significant difference between the Manitoba legislation and both PIPEDA and its substantially similar counterparts relates to oversight and enforcement. The Manitoba Ombudsman is given extremely limited oversight powers under the legislation, and there is no mechanism through which the public can make complaints regarding the handling of their personal information by private sector organizations. Instead, the Manitoba legislation offers only judicial recourse. For example, individuals are given a right of action in a court of competent jurisdiction where an organization has failed to take proper care of information under its control, or for failure in its duty to notify of a significant security breach in respect of personal information.The Act also provides that it is an offence to willfully collect, use or disclose personal information in contravention of the Act, to wilfully attempt to access personal information, or to dispose, alter, falsify, conceal or disclose personal information in order to evade a request for access. These offences require the acts to be willful, setting a rather high threshold. The legislation provides a defense where the organization is considered to have “acted reasonably in the circumstances.”The mens rea requirement will likely make prosecutions rare; in any event, they will be beyond the power of individuals to initiate and pursue on their own. Without a complaint mechanism and without the power to control prosecutions of offenses, the individual is left with no other option but to take an organization to court. As we have seen with court actions under PIPEDA, the damage awards are typically too low to make this kind of recourse practicable. An individual who is willing to take the time and effort to represent themselves in small claims court might walk away with a few dollars, but for many types of mishandling of personal information a complaints mechanism would be far more effective in guiding an organization to modify its practices while at the same time reassuring individuals that something has been done to rectify the problem.

The lack of effective oversight and the lack of an accessible complaints mechanism, in my view make this legislation very far from being substantially similar to PIPEDA. Basic normative requirements are essentially meaningless without appropriate oversight. It is worth noting that even with PIPEDA’s much more significant oversight provisions, the Privacy Commissioner of Canada has grown frustrated with the limits of her own lack of order-making powers under PIPEDA, and with the lack of additional powers to impose fines or penalties in appropriate circumstances. The Manitoba legislation is a long way from what should be required of a province that wishes to remove its private sector organizations out from under the reach of PIPEDA.

The introduction to this report makes plain the frustration of those charged with administering the Personal Information Protection and Electronic Documents Act (PIPEDA). Enacted with much fanfare in 2001, this statute contains a provision that requires that it be reviewed every 5 years to ensure that it remains adequate for the task of protecting the personal information of Canadians in commercial contexts. As the introduction to the Report notes, the first 5 year review ended with a Bill to amend the statute – this Bill died on the order paper and in spite of attempts to resuscitate it, it has never been passed. The second 5 year review has simply stalled. In the meantime, as the report notes, the personal data landscape has been dramatically transformed with the rise of social networking, mobile communications, increased cross-border data collection and sharing, and the growing use of personal information for the profiling and targeting of consumers

PIPEDA is a fairly tentative piece of legislation, giving only ombudsperson powers to the Privacy Commissioner, and favouring an approach that encourages compliance rather than mandating it. This new report issued by the Office of the Privacy Commissioner (OPC) makes it clear that this approach is no longer effective nor is it appropriate to the current data protection context. The Report notes that comparable jurisdictions have moved towards giving data commissioners more powers of enforcement, including order-making powers and the ability to impose fines or other administrative penalties on companies that play fast and loose with personal information. PIPEDA even lags behind the laws of those few provinces that have their own private sector data protection statutes: Commissioners in Quebec, B.C. and Alberta have order making powers, and Alberta also has mandatory data breach notification requirements. The report observes that not only is the toothless PIPEDA a difficult tool to use to gain compliance from large web-based collectors of personal information that are based outside of Canada, it also relies too heavily upon the willingness of domestic companies to take the Commissioner’s findings or audit reports seriously.

The OPC report identifies four pressure points based on their 12 years of experience with the legislation, and makes four recommendations for legislative reform to address each of these.The first pressure point is enforcement. The report explains how the lack of enforcement powers has hindered the ability of the OPC to address data protection issues. It notes, for example, that there is “nothing in the law that provides enough incentive for organizations to invest in privacy in significant ways.” (at p. 6). It notes as well that even when complaints lead to investigation and recommendations, companies may renege on agreements to change practices because there is nothing to compel them to do so. The report laments that other jurisdictions have taken steps to enhance their enforcement powers while nothing is done in Canada. As a result, the report recommends that stronger enforcement powers be added to the legislation. It identifies as possibilities: adding statutory damages powers to enhance the damages available to complainants who ultimately take their issues to Federal Court; giving the Commissioner order-making powers; and giving the Commissioner the power to impose administrative monetary penalties. Ideally, all three should be added. I note in particular that while statutory damages will improve the individual recourse under the Act, this on its own will not greatly improve compliance under the legislation (see my earlier blog post on individual recourse in privacy cases).

The second pressure point identified in the report is the lack of mandatory reporting for data breaches. The Report notes that as things currently stand, organizations who voluntarily report a data breach face negative publicity, while those who cover up breaches are insulated from reproach. A mandatory data breach reporting provision (which is what the report recommends) would ensure that Canadians are made aware of data breaches, would give Canadians a much clearer picture of the state of personal data security, and would create strong incentives for organizations to improve their privacy practices.

The third pressure point identified is an interesting and important one. PIPEDA contains a provision which allows organizations to voluntarily share personal information with police or other authorities without the consent of the individuals to whom the information relates. Given the increasingly high volumes of personal data in the hands of private sector actors, and the fine grain of detail of much of this information (for example, it may include detailed location information about the movement of individuals over extended periods of time), this should be a matter of great concern. At present there is little or no transparency about the number of requests made by law enforcement for this type of information, nor is there any transparency about the number of times private sector organizations voluntarily share information without insisting upon a warrant. The report’s third recommendation is to require organizations “to publicly report on the number of disclosures they make to law enforcement. . . without knowledge or consent, and without judicial warrant, in order to shed light on the frequency and use of this extraordinary exception.” (at p. 14)

The final pressure point identified in the report is that of demonstrating accountability. Although accountability of organizations for compliance with data protection laws is one of the privacy principles set out in PIPEDA, the report notes that the record of accountability of private sector actors is not all it should be. Not only does the OPC expend significant resources on investigations and audits, they are forced to invest additional resources in follow ups to ensure that there has been compliance with their recommendations.The report recommends that the accountability principle in PIPEDA be amended to require organizations to demonstrate, on the request of the OPC, that they are actually compliant with the law. Further, the report recommends that the law provide for “enforceable agreements” – in other words, undertakings by organizations to comply with the legislation that can be enforced by the OPC if compliance is not actually forthcoming.

Commissioner Jennifer Stoddart is approaching the end of the second term of her appointment. Her leadership of the OPC has been exemplary; she has taken it from a beleaguered and unstable agency to one that has proven its expertise and effectiveness. It has worked with great effectiveness with federal departments and agencies, it has developed effective strategies for public outreach and education, and it has worked tireless to improve data protection in the private sector. The Commissioner has also maintained a high level of communication and collaboration with other data commissioners in Canada and abroad. In short, she has done as much – perhaps more – than one could expect to address the privacy of Canadians in both the public and private sectors under two neglected and outdated privacy statutes. This report is notable for the frank and direct way it publicly addresses the deficiencies in Canada’s private sector data protection legislation. Since the mandated legislative review process set out in PIPEDA has proven utterly ineffective in doing so, the Commissioner has taken the initiative, addressing Canadians directly to explain in plain and direct terms what the problems are and how they might be fixed. Let us hope that the government is listening.

Privacy is big news these days, particularly when it comes to online activity. Internet users are increasingly being tracked by websites they visit, by advertisers on those sites, and by their mobile apps. Profiling practices are ubiquitous. Information and activities on social networking sites are mined by “big data” for purposes that are hardly transparent to users. It is in this context that the Standing Committee on Access to Information, Privacy and Ethics has just released its report on Privacy and Social Media in the Age of Big Data.

The report outlines many of the challenges and issues facing individuals and regulators in the social media context. There are significant issues around how consumer consent is obtained to the collection, use and disclosure of their personal information, the unlimited nature of information collected, the uses to which harvested information is put, and the length of time information is retained. Some testimony before the Committee specifically addressed the added challenges raised by the collection of the personal information of children. Issues of accountability, transparency and security are also considered in the report, and the Committee heard testimony regarding the practices of specific social media companies, and the measures being adopted by the Federal Trade Commission in the US.

Given the broad scope of the inquiry and the importance of the issues, the Committee’s recommendations are a letdown. The first three recommendations consist largely of statements urging the Privacy Commissioner of Canada to develop new guidelines to address privacy challenges with social media. The recommendations which follow encourage both government and social media companies to support education, to promote safe online activities and to support digital literacy. While guidelines and education clearly have a role to play, the recommendations do not go far enough, and in particular, they ignore the sorry state of Canada's private sector data protection law.

During the course of its inquiry, the committee heard plenty of evidence about the lack of movement on long overdue legislative reform to the Personal Information Protection and Electronic Documents Act (PIPEDA), and about how the proposed amendments to this law in Bill C-12, which has languished for some time now, may already be out of date. The Committee also heard evidence about the need for enhanced powers of enforcement for the federal Privacy Commissioner who managed to do her job admirably well with largely only the power to cajole and encourage compliance. That the recommendations of the Committee are entirely silent on the need to amend PIPEDA to add data breach notification requirements, the power to levy fines, order-making powers or other enforcement measures is simply stunning.

One can be grateful, at least, for the recommendations contained in the Supplemental Report of the New Democratic Party of Canada. The NDP members of the Committee clearly took away a different message from these hearings than did the other members. The NDP makes a number of recommendations for legislative amendments that would enhance the enforcement power of the Privacy Commissioner. These include recommendations for legislative change to require companies to notify the Privacy Commissioner in cases of serious breaches of data security, to enhance the enforcement powers of the Commissioner, and to implement “do not track” functions. Indeed, earlier this year, the NDP’s Charmaine Borg (who sits on the Standing Committee) introduced a private members bill (Bill C-475) that would amend PIPEDA so as to implement some of these recommendations around data breach notification and enforcement powers.

The soft approach to privacy protection has not proven adequate to deal with the pervasive, intensive and ubiquitous data collection practices which have become the norm in our digitized society. The almost daily accounts of data breaches and their negative impacts on individuals are evidence of the failure of gentle encouragement to achieve regulatory compliance with even the most basic privacy norms. It is past time to update and upgrade Canada’s data protection legislation. It is most disappointing to see a Standing Committee report that can study these issues and conclude only that gentle encouragement is still the path to follow.

Teresa Scassaand Anca Sattler, “Location-Based Services and Privacy”, forthcoming in (2011) Canadian Journal of Law and Technology

The last decade has seen a rapid growth in the number and variety of location-based services that are available to consumers.These include applications that permit users to call up a variety of different information about their current locations. Location-based services (LBS) also allow individuals to share their location with friends in a wide range of social networking contexts.Location-based services also permit information to be pushed automatically to users based on their location.

Many location-based services offer real benefits to users. Yet LBS raises inevitable user privacy concerns.In some applications, privacy issues will arise between individual users, where, for example, applications permit the tracking of movements of family members, co-workers or “friends”.Location-based services may also result in the collection of a new layer of personal information about consumers by private sector companies.Information about individuals and their movements has meaningful commercial value, and the potential for the collection, use and disclosure of this information is significant.Location-based services also raise the spectre of state surveillance of individual activity – either concurrent with an individual’s movements (tracking), or retrospectively, through searching records of individual patterns of movement.

In this paper we begin by describing location-based services, their evolution and their future directions.We then outline privacy issues raised by such services.We consider how current Canadian data protection laws apply to location-based services, and indicate where such laws fall short of addressing the full range of issues such services raise. We also explore some technological methods to address the privacy challenges raised by location-based services.The paper concludes with a series of recommendations.